What "open source" really means in 2026 (and why licenses matter more than ever)
The phrase "open source" has been stretched in the AI tooling category to the point where it has lost most of its meaning. A project can call itself open source today and still ship 40% of its features behind a paid Enterprise wall, require a Contributor License Agreement that lets the vendor relicense your patches, or sit under a source-available license (BSL, SSPL, the Open WebUI License) that the Open Source Initiative does not recognise as open source at all.
If you are evaluating an open-source AI chatbot in 2026, the first thing to look at is not the GitHub star count, the demo video, or the homepage marketing. It is the LICENSE file in the repository root. That one file decides three things that matter:
- Whether you can deploy it commercially without a license fee. Apache 2.0, MIT, and BSD-3-Clause say yes with almost no strings. AGPL-3.0 says yes but with copyleft obligations. BSL, SSPL, and proprietary "open-core" licenses say "yes for now, sometimes, with conditions."
- Whether you can modify it and keep your modifications private. Permissive licenses (Apache, MIT, BSD) say yes. AGPL says no if you serve the modified version over a network: you must publish your changes under AGPL too.
- Whether the vendor can change the rules tomorrow. A project under a CLA where contributors assign rights to the vendor can be relicensed unilaterally. We saw exactly that with Elastic in 2021, MongoDB in 2018, HashiCorp Terraform in 2023, and Redis in 2024. Each switch sparked an immediate community fork (OpenSearch, FerretDB, OpenTofu, Valkey) and left enterprises that had bet on the original product scrambling.
That last point is why license posture matters more in 2026 than it did five years ago. AI tooling is heavily venture-funded, and venture-funded open source has a long track record of relicensing toward source-available terms once the investor pressure outweighs the community goodwill. Redis switching to dual-licensing under RSALv2 and SSPLv1 in March 2024, and then walking part of that back by adding AGPLv3 in 2025, is a case study every team should read before depending on a single open-source vendor. The lesson is not "open source is dead." The lesson is "open source under a permissive OSI-approved license owned by a foundation or a clear community is durable; open source under a single corporate steward who can relicense is not."
The open-core trap: "open source" with paid features behind a wall
Almost every modern open-source AI chatbot uses some form of the open-core business model. The open-source edition (the "Community Edition") is real open source and is fine for individual use, small teams, and proofs of concept. The Enterprise Edition or Pro Edition is closed source and sits behind a license fee, and it usually contains the features that matter most for production: single sign-on, audit logs, role-based access control, multi-tenant isolation, SAML, and (increasingly) the most useful AI integrations.
This is not inherently bad. Open core is the only sustainable model that has been found for venture-funded open-source companies. But you should know which side of the wall the feature you need lives on before you commit. The pattern to watch for: a project that markets itself heavily on the open-source angle but where the AI features specifically (embeddings, retrieval, agent flows, evaluation) are routed through paid endpoints or an Enterprise SKU.
The honest disclosure on every project below is one paragraph titled "Enterprise wall," and it tells you exactly what is gated. If a project has nothing gated, we say so. If a project gates SSO and audit logs (the typical pattern), we say so. If a project gates the AI features themselves, we say so loudly.
Evaluation criteria
We scored every project on seven things, weighted by what matters when you actually deploy this in production.
License clarity and OSI status. OSI-approved permissive (MIT, Apache, BSD): top score. OSI-approved copyleft (AGPL): mid score, lower because of the network-effect clause. Source-available (BSL, SSPL, custom vendor licenses): low score and a callout. Dual-licensed projects are scored on the worst case the typical user will hit.
Maintainer transparency. Is the project run by a single VC-funded company, a foundation, or a community? Single-vendor projects carry relicense risk. Foundation-stewarded projects (Apache Foundation, Linux Foundation) have the highest durability.
Community activity. Commit cadence over the last 90 days, number of independent contributors, issue response time. A project with one commit per month from one maintainer is a different risk profile from a project with 50 commits per week from 30 contributors.
Enterprise wall. Which features are open-source versus paid. We name them.
RAG built-in. Does the project ship retrieval-augmented generation out of the box, or do you need to wire it up yourself with LangChain or LlamaIndex glue code.
Live-chat included. Is there a human-handoff inbox in the open-source edition, or is it AI-only.
Self-host complexity. Docker-compose one-liner: low. Multi-container with vector store plus database plus reverse proxy plus auth: high.
We are explicitly NOT scoring on GitHub star counts as a quality signal. Stars are a popularity proxy that tracks marketing spend more than software quality.
#1 Botpress: the LLM-agent platform with the MIT current version and the AGPL legacy version
Botpress is the most mature project on this list in terms of years of investment and breadth of features. The current version is the "open-source hub to build and deploy GPT and LLM agents," and the LICENSE file says MIT for the current code in the main repository as of May 2026. The legacy Botpress v12, still hosted in the botpress/v12 repository and still used by some on-premise deployments, is dual-licensed under AGPL-3.0 and a Botpress Proprietary License where the proprietary terms apply if you toggle them in the bot's interface.
Pros. MIT on the current code is as permissive as it gets, which means commercial deployment without copyleft obligations. The platform ships with a visual flow editor, an integrations hub, LLM-agent orchestration, and a hosted cloud option for teams who do not want to self-host. Community is large and active.
Cons. The current Botpress and v12 are different products with different licenses, and the documentation can blur this. If you spin up an "old tutorial" image you may end up on AGPL legacy code without realising it. The cloud product is the company's commercial wedge; the OSS edition is real but the polish tilts toward the hosted plan.
Best for. Teams that want a visual builder, LLM-agent orchestration, and the option of either self-hosting or moving to the vendor's cloud later. Verify which version you are running before you ship to production.
#2 Chatwoot: the MIT-licensed live-chat and helpdesk with AI on top
Chatwoot is the open-source alternative to Intercom and Zendesk. The repository is MIT licensed and the community is one of the most active in the open-source customer-support space, with the project routinely cited around 22,000-plus stars and a steady commit cadence from a wide contributor base. The AI features (Captain AI for suggested replies, conversation summaries) sit on top of the same MIT-licensed product, with the AI add-on routed through either OpenAI or a self-hosted LLM of your choice.
Pros. True MIT license on the core product. Multi-channel inbox (email, website, WhatsApp, Instagram, Messenger, SMS, API channel for custom apps) ships in the open-source edition. Live-agent handoff is the core of the product, not an afterthought. The self-hosted Docker-compose deployment is well-documented and works.
Cons. Chatwoot is a helpdesk first and an AI chatbot second. If you want a deeply autonomous LLM agent, you will need to layer in retrieval yourself. Some advanced features (high-volume usage on the cloud plan, certain integrations) sit in the paid hosted tier; the self-hosted edition is feature-complete for most teams but the hosted plan is the commercial wedge.
Best for. Teams that want a real multi-channel customer-support inbox with AI assistance and live-agent handoff in a single MIT-licensed product. The strongest pick on this list if your priority is the inbox shape rather than the LLM-agent shape.
#3 Rasa: the Apache 2.0 conversational AI framework with a separate paid Pro tier
Rasa is the long-standing open-source conversational AI framework that predates the LLM era and has adapted to it. The main rasa repository is Apache 2.0 licensed. There is a separate commercial Rasa Pro product (closed source, paid) that adds enterprise features (CALM dialogue understanding with LLMs, enterprise SSO, voice channels at scale, on-premise deployment support). Community is in the high tens of thousands of stars range with steady commits.
Pros. Apache 2.0 is the most permissive license you can practically ship under for commercial use. The dialogue management engine is genuinely sophisticated and supports both rules-based and ML-based intents. Strong NLU pipeline, multi-language support, and a mature CLI for training and evaluation. Self-hosted by design; no forced cloud.
Cons. Rasa is more of a framework than a product. You write configuration files, train a model, and deploy a server. There is no visual flow editor in the open-source edition. The newer LLM-native features (CALM) are mostly in Rasa Pro. The Community Edition still works well but the project's investment is visibly tilting toward Pro.
Best for. Engineering teams with Python skills who want a self-hosted, Apache 2.0-licensed framework with no copyleft obligations and full control over the training pipeline. Less ideal for non-technical teams who want a UI.
#4 AnythingLLM: the MIT all-in-one document chat with built-in RAG
AnythingLLM by Mintplex Labs is one of the newer entrants and has emerged as a serious open-source choice in the document-chat and internal-knowledge-base category. MIT licensed across the main repository, the docs, and the browser extension. Ships as a Docker image and a desktop application, with built-in RAG, multi-user workspaces, and connectors for a wide range of LLM providers (Anthropic, OpenAI, Ollama for local models, Azure, Bedrock).
Pros. Genuine MIT license with no apparent Enterprise wall on the AI features themselves. The desktop app is unusual in the category and means you can run an entire local-first RAG chatbot on a laptop without any cloud dependency. Multi-user mode is straightforward. The "AI productivity accelerator" framing maps well to the internal-wiki and team-knowledge-base use case.
Cons. Smaller project than Botpress or Chatwoot, with a tighter contributor base. Documentation is improving fast but still trails the leaders. Some integrations are newer and rougher edges show up.
Best for. Teams building an internal document chat or knowledge-base assistant on their own infrastructure, especially if local-first (Ollama, on-prem LLMs) is a hard requirement. Strongest pick for the "we cannot send any data to a third party" use case.
#5 Flowise: the Apache 2.0 visual builder with a separate Enterprise edition
Flowise is the visual builder for AI agents and LLM apps. The Community Edition is Apache 2.0 licensed; a separate Enterprise Edition with its own license sits alongside it for paying customers. The project is well-known for its drag-and-drop interface and is widely cited around 12,000-plus stars on GitHub.
Pros. Apache 2.0 on the Community Edition is genuinely permissive. The visual builder lowers the barrier for non-engineering team members to compose retrieval flows, agents, and tools. Integrations with LangChain components are first-class. Self-hosted deployment is straightforward via Docker.
Cons. Open-core in the explicit sense: the Enterprise Edition gates SSO, audit logs, workspace isolation, and some advanced agent orchestration. The line between the two editions has shifted over time, which is the classic open-core watch-out. If you are evaluating, read the current LICENSE.md carefully and check which Enterprise features have moved across the line recently.
Best for. Teams that want a visual flow builder for retrieval and agents and are comfortable with the open-core trade-off (free for small teams, paid for enterprise features). If SSO is mandatory from day one, factor in the Enterprise Edition price.
#6 LibreChat: the MIT-licensed ChatGPT-style multi-model UI
LibreChat is the open-source ChatGPT-style frontend that supports an unusually wide range of model providers (Anthropic, OpenAI, Azure, Google Vertex, Mistral, OpenRouter, Groq, AWS Bedrock) plus self-hosted models via Ollama. MIT licensed at github.com/danny-avila/LibreChat, with one of the most active contributor communities in the model-frontend category.
Pros. MIT license, no Enterprise wall in the open-source edition, and a feature set that genuinely rivals the commercial ChatGPT UI: agents, MCP support, model switching, message search, Code Interpreter, secure multi-user auth, preset prompts. Strong fit for teams who want a single internal UI in front of multiple LLM providers.
Cons. LibreChat is a chat frontend rather than a customer-facing chatbot widget. You cannot drop it on your marketing site as a visitor widget the way you can with Chatwoot. The retrieval story is improving but is not the project's centre of gravity.
Best for. Internal teams that want a self-hosted ChatGPT alternative for their employees, with multi-model support and the ability to plug in their own MCP servers and tools. Less suited for public-facing website chat.
A note on Open WebUI, which used to be on lists like this
Open WebUI was historically a strong contender in this category. As of 2026 it is no longer cleanly OSI open source. The project moved from MIT to BSD-3-Clause in early 2025 and then added an Anti-Endorsement Clause that blocks removing or altering the Open WebUI branding in deployments above a certain user threshold, which makes the license source-available rather than open source by the OSI definition. We have left it off the main list for this reason, but if you only need a personal or small-team self-hosted Ollama UI and the branding restriction does not bother you, the project is still actively developed.
License-by-license breakdown
The condensed view of the six projects in this list:
- MIT (permissive, OSI-approved): Botpress current version, Chatwoot, AnythingLLM, LibreChat. Commercial use, modification, and redistribution are all permitted with attribution. No copyleft obligation. Lowest friction for enterprise procurement and lowest risk in a relicense scenario (the existing code remains MIT forever; only future commits would change).
- Apache 2.0 (permissive, OSI-approved): Rasa, Flowise Community Edition. Same practical effect as MIT for most users, with the addition of an explicit patent grant. Apache is the preferred license for foundation-stewarded projects.
- AGPL-3.0 (copyleft, OSI-approved): Botpress v12 legacy version (dual-licensed). If you modify and serve over a network, you must publish your modifications under AGPL. Important to plan around if you intend to fork.
- BSL, SSPL, source-available custom licenses: None of the projects on this list. We mention Redis as the cautionary example of a project that switched from BSD to source-available in 2024, and Open WebUI as a project that we used to recommend but no longer count as fully open source.
The rule of thumb: MIT and Apache 2.0 are the safest bets for commercial production deployment. AGPL is fine if you understand the network clause and are willing to comply or buy a commercial license. Anything labelled "source available" is a different category and should be evaluated on its specific terms, not lumped in with open source.
When open source is the right call (and when it isn't)
Open source is the right call when:
- You need to inspect the code for security or compliance reasons, and your team has the engineering capacity to actually do so.
- You have a hard data-residency or air-gap requirement that no hosted product can meet.
- You want to avoid vendor lock-in by retaining the ability to fork and self-maintain.
- Your team has the operational maturity to run a stack: a vector store, a database, a reverse proxy, an auth provider, monitoring, backups, and on-call rotation.
Open source is the wrong call when:
- The team that will operate the chatbot is one person and the chatbot is not the main thing they work on. The total cost of self-hosting (the time, not the dollars) usually exceeds the cost of a hosted product within a quarter.
- Your priority is speed-to-launch and the chatbot is a minor surface in a broader product. A hosted SaaS chatbot installed via a script tag will be live in an hour; a self-hosted open-source stack will not.
- The features you actually need (SSO, audit logs, multi-tenant isolation) all sit on the Enterprise side of the open-core wall, in which case you are paying for the commercial edition either way and the open-source aspect is mostly a sticker.
For teams in the "wrong call" bucket, a hosted SaaS like ChatRaj is the honest answer. ChatRaj is not open source. It is a closed-source hosted product that installs via a single script tag and bills on a flat monthly quota. If your decision criterion was actually "no vendor lock-in" rather than "I need to read the source code," ChatRaj is worth a look. If you genuinely need source-code access, stay on this list.
What we deliberately did not score
Three things we left out on purpose, and why.
GitHub star counts as a quality signal. Stars correlate with marketing reach, not software quality. We mentioned approximate star counts where they were useful as a community-size proxy, but we did not rank on them.
Hosted-cloud SLAs offered by the project vendors. Every project on this list has a hosted cloud option run by the vendor. Those are commercial products with their own pricing and SLAs and are out of scope for an open-source comparison.
Speed of model upgrades. All six projects abstract away the underlying LLM and let you swap in newer models (GPT-5, Claude 4.5, Gemini 2.5) when they ship. Provider-specific latency comparisons would shift every few months and would not be a durable input to a 2026 buyer's decision.
The honest summary: pick by license first, by maintainer transparency second, by feature fit third. Star counts and demo videos come last.